CVE-2026-57380
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Extensions for Leaflet Map WordPress plugin is vulnerable to DOM-based XSS. The flaw affects versions up to and including 5.1, allowing an attacker to inject malicious scripts.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or perform other actions within the victim's browser context.
Recommendation
Immediately update the Extensions for Leaflet Map plugin to version 5.2 or later, which includes the fix.
Other vulnerabilities in Extensions for Leaflet Map
See all- CVE-2025-66093Medium
The Extensions for Leaflet Map plugin for WordPress (versions up to 4.8) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject malicious code that executes in a user's browser.
- CVE-2025-12369Medium
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS